CompTIA CompTIA Certifications CS0-002 Questions & Answers

• Question 861:

  A hybrid control is one that:

  A. is implemented differently on individual systems

  B. is implemented at the enterprise and system levels

  C. has operational and technical components

  D. authenticates using passwords and hardware tokens

  Correct Answer: B

• Question 862:

  A cybersecurity analyst is supporting an incident response effort via threat intelligence. Which of the following is the analyst MOST likely executing?

  A. Requirements analysis and collection planning

  B. Containment and eradication

  C. Recovery and post-incident review

  D. Indicator enrichment and research pivoting

  Correct Answer: D

• Question 863:

  The inability to do remote updates of certificates, keys, software, and firmware is a security issue commonly associated with:

  A. web servers on private networks

  B. HVAC control systems

  C. smartphones

  D. firewalls and UTM devices

  Correct Answer: B

• Question 864:

  When attempting to do a stealth scan against a system that does not respond to ping, which of the following Nmap commands BEST accomplishes that goal?

  A. nmap -sA -O -noping

  B. nmap -sT -O -P0

  C. nmap -sS -O -P0

  D. nmap -sQ -O -P0

  Correct Answer: C

• Question 865:

  A team of security analysts has been alerted to potential malware activity. The initial examination indicates one of the affected workstations is beaconing on TCP port 80 to five IP addresses and attempting to spread across the network over port 445. Which of the following should be the team's NEXT step during the detection phase of this response process?

  A. Escalate the incident to management, who will then engage the network infrastructure team to keep them informed.

  B. Depending on system criticality, remove each affected device from the network by disabling wired and wireless connections.

  C. Engage the engineering team to block SMB traffic internally and outbound HTTP traffic to the five IP addresses.

  D. Identify potentially affected systems by creating a correlation search in the SIEM based on the network traffic.

  Correct Answer: D

• Question 866:

  The help desk provided a security analyst with a screenshot of a user's desktop:

  

  For which of the following is aircrack-ng being used?

  A. Wireless access point discovery

  B. Rainbow attack

  C. Brute-force attack

  D. PCAP data collection

  Correct Answer: C

• Question 867:

  After receiving reports latency, a security analyst performs an Nmap scan and observes the following output:

  

  Which of the following suggests the system that produced output was compromised?

  A. Secure shell is operating of compromise on this system.

  B. There are no indicators of compromise on this system.

  C. MySQL services is identified on a standard PostgreSQL port.

  D. Standard HTP is open on the system and should be closed.

  Correct Answer: A

• Question 868:

  A security analyst discovers a vulnerability on an unpatched web server that is used for testing machine learning on Bing Data sets. Exploitation of the vulnerability could cost the organization $1.5 million in lost productivity. The server is located on an isolated network segment that has a 5% chance of being compromised. Which of the following is the value of this risk?

  A. $75.000

  B. $300.000

  C. $1.425 million D. $1.5 million

  Correct Answer: A

• Question 869:

  An organization has not had an incident for several month. The Chief information Security Officer (CISO) wants to move to proactive stance for security investigations. Which of the following would BEST meet that goal?

  A. Root-cause analysis

  B. Active response

  C. Advanced antivirus

  D. Information-sharing community

  E. Threat hunting

  Correct Answer: E

• Question 870:

  A company wants to establish a threat-hunting team. Which of the following BEST describes the rationale for integration intelligence into hunt operations?

  A. It enables the team to prioritize the focus area and tactics within the company's environment.

  B. It provide critically analyses for key enterprise servers and services.

  C. It allow analysis to receive updates on newly discovered software vulnerabilities.

  D. It supports rapid response and recovery during and followed an incident.

  Correct Answer: A